# AWS MCP Server: a crafted script got past the run_script validator

> AWS MCP Server's Python code validator missed inputs that let an authenticated caller run arbitrary code in their own session.

- **Severity:** Low: Minor, hard to exploit or mostly theoretical. Good to know.
- **Category:** Vulnerability
- **Published by:** Amazon Web Services
- **Disclosed:** 2026-10-23
- **CVE:** CVE-2026-115845
- **CVSS:** 5.3
- **Affects:** AWS MCP Server
- **Research by:** Manash Saikia
- **Primary source:** https://aws.amazon.com/security/security-bulletins/2026-149-aws/
- **Page:** https://theinjection.dev/items/aws-mcp-server-run-script-validator-bypass/

AWS MCP Server's run_script tool shipped an incomplete list of disallowed Python inputs, so an authenticated user could run arbitrary code inside their own sandboxed session. AWS says the fix is server-side.

## What happened

AWS published bulletin 2026-149 on October 23, 2026, assigning CVE-2026-115845 to a flaw in the run_script tool of AWS MCP Server. Manash Saikia reported it through the coordinated vulnerability disclosure process, AWS states. The advisory reached the GitHub Advisory Database the same day with a CVSS v4 base score of 5.3.

## How it works

run_script exists to execute Python inside a sandboxed environment, and a validator decides which inputs are allowed through. That validator's list of disallowed inputs was incomplete, the weakness class recorded as CWE-184, so a crafted script could reach code execution the validator was meant to block. Execution stayed inside the caller's own isolated session environment, which bounds the result.

## Who is affected

Authenticated users of AWS MCP Server are the only population in scope, and AWS describes the product as an exclusively hosted managed service, so there are no customer-run versions to match against. AWS adds that no workaround is needed for the tool's intended use, running Python scripts that make AWS API calls.

## What to do

No customer action is required, AWS states, because the issue was addressed service-side.

## Quick facts

- **Affected:** AWS MCP Server, the run_script tool
- **CVE:** CVE-2026-115845
- **CVSS:** 5.3, CVSS v4, per the GitHub Advisory Database
- **Weakness:** CWE-184, incomplete list of disallowed inputs
- **Status:** Fixed service-side, no customer action required
- **Found by:** Manash Saikia, via coordinated disclosure
- **Disclosed:** October 23, 2026, in AWS bulletin 2026-149

## Sources

1. [AWS Bulletin](https://aws.amazon.com/security/security-bulletins/2026-149-aws/)
2. [GitHub Advisory](https://github.com/advisories/GHSA-jmwp-36mq-x645)